CVE-2026-51715: TOTOLINK T6 vulnerability

Published Aug 31, 2026

Updated

Incorrect access control in the delMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Affected Software

1 affected component

TOTOLINK T6=4.1.5cu.748_B20211015

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade TOTOLINK T6 to a version that resolves this vulnerability.
Fixed in 4.1.5cu.748_B20211015
Compensating control
Restrict access to /cgi-bin/cstecgi.cgi so only authenticated/authorized clients (e.g., via firewall/ACL/WAF allowlisting of trusted admin IPs) can reach it.

Event History

Aug 31, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·04:18 PM

Description

Frequently Asked Questions

Does exploitation require valid credentials?

No. The issue allows unauthenticated attackers to remove MAC filter rules.

Which deployments should be prioritized for assessment?

Assess TOTOLINK T6 devices running firmware version 4.1.5cu.748_B20211015.

What attacker action is required?

An attacker must send a crafted POST request to /cgi-bin/cstecgi.cgi targeting the delMacFilterRules functionality.